legionbet-holland[.]com

Analysis of legionbet-holland.com, created on February 21 2026 and currently active, shows a high‑risk crypto gambling phishing operation. The domain resolves to IP 104.21.32.89, which belongs to AS13335 Cloudflare, Inc. in the United States, and is served through Cloudflare’s network using HSTS and HTTP/3. DNS resolution uses the nameservers dan.ns.cloudflare.com and norah.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, indicating a valid TLS handshake despite the malicious intent. HTTP responses return status code 200, confirming that the site is reachable and serving content. The page title "Legionbet Casino voor Nederland" aligns with the reported scam type of crypto gambling and matches the Gambler Scam phishing kit identified in intelligence.

VirusTotal scans report that 3 of 93 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. The domain appears on one external security blocklist and is explicitly blocked by PhishDestroy, demonstrating that at least some filtering services have already taken action. The registrar listed is NiceNIC International Group Co., Limited, which is a known provider for rapid domain registration.

Defenders should incorporate legionbet-holland.com into URL filtering and DNS sink‑hole policies, monitor for any related C2 traffic to the Cloudflare IP, and consider adding the IP address 104.21.32.89 to network‑level blocklists. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection coverage. Because the site leverages legitimate TLS and a reputable CDN, detection based on certificate anomalies is unlikely; focus should remain on domain reputation, blocklist matches, and the identified phishing kit signature. The current evidence suggests a sustained malicious campaign, and proactive blocking is recommended to mitigate user exposure.